PT-2018-11161 · Gnome+1 · Gnome Evolution+1

Published 2018-06-15 · Updated 2024-08-05 · CVE-2018-12422

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNOME Evolution versions through 3.29.2

Description The issue might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function in the e-book-backend-ldap.c file. However, the software maintainer disputes this, stating that the code had computed the required string length first and then allocated a large-enough buffer on the heap.

Recommendations For versions through 3.29.2, consider this issue disputed and no specific fix is provided, however, as a precautionary measure, restrict access to the e-book-backend-ldap.c file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-2310

CVE-2018-12422

Affected Products

Alt Linux

Gnome Evolution

References · 13

• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12422 · Security Note
• https://bugzilla.gnome.org/show_bug.cgi?id=796174 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12422 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12422 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-12422 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12422 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/evolution-data-server/commit/34bad6173 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12422 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-12422 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-2310 · Vendor Advisory
• https://packages.altlinux.org/ru/vuln/CVE-2018-12422 · Note
• https://t.me/cvenotify/89143 · Telegram Post